Ontology knowledge framework construction method and related product

Abstract

The application discloses an ontology knowledge framework construction method and related products, the method comprises the following steps: defining a knowledge framework based on an application scenario to obtain an ontology knowledge framework; mapping the knowledge in the knowledge base of each source to the ontology knowledge framework to obtain mapping data; storing the mapping data in the ontology knowledge framework to obtain a stored ontology knowledge framework; performing knowledge completion and fusion processing on the stored ontology knowledge framework to obtain a processed ontology knowledge framework; and projecting the knowledge in the processed ontology knowledge framework to a semantic space that allows calculation to obtain a target ontology knowledge framework. The application breaks through the bottlenecks of traditional multi-library fragmentation, semantic inconsistency and difficulty in calculation, and realizes deep fusion, dynamic evolution and computable expression of multi-source knowledge.

Description

Technical Field

[0001] This application relates to the field of knowledge management technology, and in particular to an ontology knowledge framework construction method and related products. Background Technology

[0002] Currently, the following technical solutions are commonly used in the field of knowledge management: First, traditional relational database solutions, which use RDBMS such as MySQL and PostgreSQL to store structured knowledge and achieve data retrieval through SQL queries. They have mature transaction processing and consistency guarantees and are the mainstream choice for enterprises. Second, knowledge graph solutions, which are based on graph databases such as Neo4j and ArangoDB or RDF triple storage. They model entities and relations through ontology, support SPARQL queries and logical reasoning, and can express complex semantics but are limited by symbolic computation efficiency. Third, vector database solutions, which use systems such as Milvus, Pinecone, and Weaviate to store vector representations of knowledge. They rely on vector similarity to achieve efficient semantic retrieval. Although they have fast computation speed, they lack structured constraints and logical reasoning capabilities. Fourth, multi-database independent solutions, where some systems deploy RDBMS, knowledge graphs, and vector libraries simultaneously, but the three run independently without a coordination mechanism, resulting in difficulties in data synchronization, high consistency maintenance costs, and difficulty in achieving unified representation and multi-dimensional computation of knowledge.

[0003] Current solutions suffer from significant technical bottlenecks: the three-layer databases are fragmented, forming knowledge silos, making data updates difficult to synchronize and increasing consistency maintenance costs by 30% to 50%, hindering cross-layer knowledge reasoning; the semantic gap is prominent, RDBMS struggles to express complex semantic relationships, knowledge graph reasoning is inefficient in large-scale scenarios, and vector libraries are prone to semantic drift, making semantic conversion between the three difficult and restricting multi-dimensional knowledge fusion; knowledge completion relies on manual intervention, making it difficult for the system to automatically discover missing information, and implicit relationships are easily overlooked in scenarios such as security posture, RDBMS has weak completion capabilities, knowledge graph rules are complex, and vector libraries are prone to illusions; facing multi-format, multi-granularity knowledge from heterogeneous sources such as logs, alerts, intelligence, and rule bases, existing methods lack a unified representation framework, making it difficult to effectively integrate cross-domain knowledge for correlation analysis; computational efficiency is insufficient, symbolic reasoning of knowledge graphs takes seconds to minutes on millions of entities, and vector computation is limited by dimensions and measurement methods, making it difficult for the two to work efficiently together and unable to meet the real-time large-scale reasoning needs such as millisecond-level threat analysis. Summary of the Invention

[0004] To address the aforementioned issues, this application provides a method for constructing an ontology knowledge framework and related products. The aim is to overcome the bottlenecks of traditional multi-database fragmentation, semantic inconsistency, and computational difficulty, and to achieve deep integration, dynamic evolution, and computable expression of multi-source knowledge.

[0005] The embodiments of this application disclose the following technical solutions: The first aspect of this application provides a method for constructing an ontology knowledge framework, the method comprising: The ontology knowledge framework is obtained by defining the knowledge framework based on the application scenario. The knowledge in the knowledge base of each source is mapped to the ontology knowledge framework to obtain the mapping data; The mapping data is stored in the ontology knowledge framework to obtain the stored ontology knowledge framework; The stored ontology knowledge framework is subjected to knowledge completion and fusion processing to obtain the processed ontology knowledge framework. The knowledge in the processed ontology knowledge framework is uniformly projected onto a computationally allowed semantic space to obtain the target ontology knowledge framework.

[0006] A second aspect of this application provides an ontology knowledge framework construction apparatus, the ontology knowledge framework construction apparatus comprising: The definition module is used to define the knowledge framework based on the application scenario, and obtain the ontology knowledge framework. The mapping module is used to map the knowledge in the knowledge base of each source to the ontology knowledge framework to obtain mapping data; The storage module is used to store the mapped data into the ontology knowledge framework to obtain the stored ontology knowledge framework; The processing module is used to perform knowledge completion and fusion processing on the stored ontology knowledge framework to obtain the processed ontology knowledge framework. The projection module is used to uniformly project the knowledge in the processed ontology knowledge framework onto a semantic space that allows computation, thereby obtaining the target ontology knowledge framework.

[0007] The third aspect of this application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the ontology knowledge framework construction method provided in the first aspect.

[0008] Compared with the prior art, this application has the following beneficial effects: This application includes defining a knowledge framework based on an application scenario to obtain an ontology knowledge framework; mapping the knowledge in the knowledge base of each source to the ontology knowledge framework to obtain mapping data; storing the mapping data in the ontology knowledge framework to obtain a stored ontology knowledge framework; performing knowledge completion and fusion processing on the stored ontology knowledge framework to obtain a processed ontology knowledge framework; and uniformly projecting the knowledge in the processed ontology knowledge framework to a computationally allowed semantic space to obtain a target ontology knowledge framework.

[0009] This application utilizes multiple knowledge bases from various sources to effectively aggregate heterogeneous and multi-source knowledge resources, laying a data foundation for subsequent fusion. A knowledge framework is defined based on specific application scenarios, ensuring that the ontology structure highly aligns with actual business needs and enhancing the relevance and practicality of knowledge representation. Knowledge from various sources is uniformly mapped to this ontology framework, achieving semantic alignment and format normalization, eliminating terminological ambiguity and structural differences. Subsequently, the mapped data is integrated and stored in a unified ontology, forming a structurally consistent and manageable knowledge foundation. Based on this, knowledge completion and fusion processing significantly improve the completeness, consistency, and coherence of knowledge. The processed ontology knowledge is uniformly projected onto a computationally compliant semantic space, enabling knowledge to retain structured semantic relationships while possessing efficient computational and reasoning capabilities. This application overcomes the bottlenecks of traditional multi-database fragmentation, semantic inconsistency, and computational limitations, achieving deep fusion, dynamic evolution, and computable expression of multi-source knowledge. Attached Figure Description

[0010] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0011] Figure 1 A flowchart illustrating an ontology knowledge framework construction method provided in this application embodiment; Figure 2 A flowchart illustrating the completion and fusion process provided for embodiments of this application; Figure 3 A flowchart of the projection provided in the embodiments of this application; Figure 4 An optimized flowchart provided for embodiments of this application; Figure 5 A schematic diagram illustrating the ontology knowledge framework construction method provided in this application embodiment; Figure 6 This is a structural diagram of an ontology knowledge framework construction device provided in an embodiment of this application. Detailed Implementation

[0012] As described earlier, current mainstream knowledge management technologies include relational databases, knowledge graphs, vector databases, and multi-database parallel solutions. Each has its advantages in structured storage, semantic representation, and semantic retrieval, but they generally suffer from problems such as system fragmentation, semantic gaps, difficulties in knowledge completion, insufficient heterogeneous integration, and low computational efficiency. Independent operation of the three types of databases leads to difficulties in data synchronization and consistency maintenance costs as high as 30% to 50%. RDBMS lacks semantic expressiveness, knowledge graphs have low reasoning efficiency, and vector databases are prone to semantic drift and cannot perform logical reasoning. Knowledge completion relies on manual intervention and is difficult to automatically discover implicit relationships. There is a lack of a unified representation framework for multi-source heterogeneous knowledge. Symbolic reasoning and vector computation are difficult to coordinate, failing to support the needs of large-scale real-time analysis at the millisecond level, severely restricting the evolution and application of intelligent knowledge systems.

[0013] In view of the above problems, this application provides a method for constructing and generating an ontology knowledge framework and related products. The method includes: defining a knowledge framework based on an application scenario to obtain an ontology knowledge framework; mapping the knowledge in the knowledge base of each source to the ontology knowledge framework to obtain mapping data; storing the mapping data in the ontology knowledge framework to obtain a stored ontology knowledge framework; performing knowledge completion and fusion processing on the stored ontology knowledge framework to obtain a processed ontology knowledge framework; and uniformly projecting the knowledge in the processed ontology knowledge framework to a computationally permissible semantic space to obtain a target ontology knowledge framework.

[0014] This application effectively aggregates knowledge resources from different sources to build a unified data foundation; it designs a knowledge ontology framework that highly matches business needs based on specific application scenarios, improving the relevance of representation; it then maps knowledge from various sources to this ontology, achieving semantic alignment and format normalization, eliminating differences in terminology and structure; it integrates and stores this knowledge into a unified knowledge base with consistent structure and manageability; subsequently, through knowledge completion and fusion, it enhances the completeness, consistency, and coherence of knowledge; and it projects ontology knowledge onto a semantic space that supports efficient computation, endowing it with computability and reasoning capabilities while preserving structured semantic relationships. This effectively overcomes the technical bottlenecks of traditional multi-database fragmentation, semantic inconsistency, and difficulty in collaborative computation, achieving deep fusion, dynamic evolution, and intelligent application of multi-source knowledge.

[0015] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present application.

[0016] See Figure 1This diagram illustrates a method for constructing an ontology knowledge framework, which includes: S101: Define the knowledge framework based on the application scenario to obtain the ontology knowledge framework.

[0017] This application does not limit the specific definition method of the knowledge framework, and can flexibly adopt advanced paradigms including but not limited to Palantir's ontology design ideas to construct a unified knowledge representation standard oriented towards business semantics. Specifically, referring to Palantir's ontology modeling concept, this application introduces the following core mechanisms: Object Type: Unifies the abstraction of entities, concepts, events, etc. from multi-source heterogeneous systems into objects, realizing the generalized expression of knowledge; Multiple inheritance and role mapping: Allows object types to support multiple inheritance, and can be dynamically assigned different roles according to the context (such as "user" can play the role of "attacker" or "victim" in a security scenario), enhancing semantic flexibility; Link: Explicitly models complex relationships between objects (such as "belongs to", "triggers", "influences", etc.), supporting the construction of high-order semantic networks; Property & Computed Property: In addition to static properties, it supports the dynamic generation of computed properties (such as risk scores and association strength) through functions or rules, improving the real-time and intelligent nature of knowledge; Event & Time Series: Natively supports time-series data modeling, embedding dynamic information such as alarms, logs, and behaviors into the ontology in the form of event streams, supporting time-series reasoning and evolutionary analysis.

[0018] Through the above mechanism, the ontology knowledge framework constructed in this application not only has strong expressive power and business adaptability, but also naturally supports subsequent knowledge mapping, fusion, completion and computable projection, laying a solid foundation for the unified management and intelligent reasoning of multi-source knowledge.

[0019] S102: Map the knowledge in the knowledge base of each source to the ontology knowledge framework to obtain the mapping data.

[0020] This application does not limit the specific implementation method of knowledge mapping. Methods such as rule-driven, template matching, machine learning, or large model assistance can be flexibly adopted based on the structure, semantic granularity, and application scenario of the source data. For example, the following mapping strategy can be executed: Structured data mapping (such as relational databases): By mapping fields to object attributes / links, table records are converted into object instances in the ontology, and foreign key relationships are used to build links between objects; Semi-structured data mapping (such as JSON, XML, logs): Based on path expressions or pattern extraction, identify entities and relationships, and align them to the corresponding object types and link types in the ontology; Unstructured text mapping (such as reports, intelligence, and alarm descriptions): Leveraging the semantic understanding capabilities of Named Entity Recognition (NER), Relation Extraction (RE), and Large Language Model (LLM), objects, attributes, and relationships are automatically extracted and projected into the ontology framework; Graph or triplet data mapping: Map nodes and edges in RDF triples or graph databases to objects and links in the ontology based on semantic equivalence, preserving the original topology while achieving ontology alignment; Dynamic event stream mapping: Real-time generated alarms, operation logs and other time-series data are parsed into Event objects and associated with relevant subject objects to form a semantic event chain with timestamps.

[0021] During the mapping process, terminology normalization (such as synonym merging and unit standardization), conflict resolution (such as attribute value conflict arbitration), and confidence labeling are supported to ensure that the mapping results are semantically consistent, structurally compliant, and of controllable quality. The final output mapping data not only conforms to the specifications of the ontology knowledge framework but also retains the semantic details and contextual information of the source knowledge, providing high-quality input for subsequent unified storage, fusion, and computation.

[0022] S103: Store the mapping data in the ontology knowledge framework to obtain the stored ontology knowledge framework.

[0023] This application does not limit the specific storage method; storage strategies can be flexibly selected based on object type, access mode, computational requirements, and system architecture. For example, a multimodal collaborative storage architecture can be adopted, where mapped data is written into heterogeneous storage engines associated with the ontology knowledge framework according to semantic type and functional characteristics, achieving efficient management with logical unity and physical adaptation. Structured objects and static attributes (such as users, devices, and assets) are stored in relational databases (such as PostgreSQL and MySQL) or graph databases (such as Neo4j) to ensure transactional consistency and complex query capabilities. Semantic links and topological relationships between objects (such as "attack source → target" and "dependency → component") should be stored in graph databases or RDF triple libraries (such as Apache Jena and Ontotext GraphDB) to efficiently support path traversal, subgraph matching, and graph neural network inference. High-dimensional vector representation and semantic embedding (such as embedded vectors of text descriptions and behavioral features): stored in vector databases (such as Milvus, Weaviate, and Pinecone), supporting fast retrieval and clustering based on similarity; Event and time-series data (such as security alerts, operation logs, and indicator streams): are written to time-series databases (such as InfluxDB and TimescaleDB) or storage systems that support event sourcing, facilitating backtracking analysis and dynamic evolution modeling. Computational attributes and derived knowledge (such as risk scores, association strength, and threat levels) can be calculated in real time as needed or pre-calculated and cached in an in-memory database (such as Redis) or columnar storage (such as ClickHouse), balancing performance and flexibility.

[0024] The aforementioned storage process is uniformly scheduled by the ontology knowledge framework. Through metadata registration, data routing, and consistency protocols, it ensures that each storage unit logically constitutes a complete and consistent knowledge foundation. Simultaneously, it supports cross-storage composite indexes, transaction coordination, and version control, providing reliable and efficient data support for subsequent knowledge fusion, completion, and computable projection.

[0025] S104: Perform knowledge completion and fusion processing on the stored ontology knowledge framework to obtain the processed ontology knowledge framework.

[0026] This application does not limit the specific methods for knowledge completion and fusion. It can combine techniques such as rule-based reasoning, graph neural networks, and large language models (LLM) to achieve semantic-level integrity enhancement and consistency optimization. For example, the following strategies can be adopted: By leveraging large language models to perform deep semantic understanding of objects, attributes, and link contexts in the ontology, potential missing information can be identified. For example, prompt engineering guides the model to answer questions such as "What undeclared attributes might an entity possess?" or "Do two seemingly unrelated objects have an implicit relationship?", thereby generating candidate completion triples. Simultaneously, the model can assist in inferring computed attributes (such as deriving a user's risk level from behavioral logs), enhancing the ability to dynamically represent knowledge.

[0027] For object instances from different sources but pointing to the same real-world entity, entity resolution techniques (such as similarity matching, clustering, and embedding alignment) are used for fusion. In cases where attribute values ​​or relationships conflict, strategies such as confidence weighting, time priority, and authoritative source priority are introduced for arbitration to ensure the consistency and reliability of the fused knowledge.

[0028] Hidden relationships can be mined from ontology graphs using graph neural networks (GNNs) or path reasoning algorithms (such as rule mining and path ranking). For example, if there is a path A→use→B→vulnerability→C, it can be inferred that A may be affected by C, and new affected links can be generated to achieve relational chain completion.

[0029] Perform time-series logic verification on events and time-series data (such as causal order and rationality of state transitions), correct contradictory event flows, and abstract dynamic evolution patterns (such as attack phase evolution and asset state migration) into high-level ontology patterns to achieve deep integration of static knowledge and dynamic behavior.

[0030] Through the aforementioned multi-dimensional and multi-level completion and fusion mechanisms, this application significantly improves the completeness (covering more entities and relationships), consistency (eliminating logical and semantic conflicts), and coherence (supporting cross-domain and cross-temporal semantic connectivity) of the ontology knowledge framework, laying a high-quality knowledge foundation for the subsequent construction of a computable semantic space.

[0031] S105: Project the knowledge in the processed ontology knowledge framework to a semantic space that allows computation to obtain the target ontology knowledge framework.

[0032] This application does not limit the specific projection method; its core purpose is to transform multi-source heterogeneous knowledge, including structured, semi-structured, and reasoned supplementary knowledge, into a unified semantic representation that is computable, measurable, and operable, thereby supporting efficient knowledge retrieval, reasoning, analysis, and decision-making. Exemplary projection methods include, but are not limited to: By leveraging knowledge graph embeddings (such as TransE, RotatE, and ComplEx) or large language models (such as Sentence-BERT, Instructor, and LLM-based encoder), objects, attributes, and relationships are mapped to low-dimensional dense vectors, constructing a continuous semantic space. In this space, semantic similarity can be quantified by vector distance (such as cosine similarity and Euclidean distance), supporting approximate nearest neighbor search, clustering, and analogical reasoning.

[0033] This application transforms the original ontology knowledge framework, which was based on semantic modeling, into a target ontology knowledge framework that combines semantic fidelity and computational friendliness. It not only preserves the logical structure and business meaning of the original knowledge but also naturally adapts to the needs of modern AI systems for efficient, scalable, and interpretable computation, providing a solid knowledge foundation for upper-layer applications (such as intelligent question answering, risk prediction, and automated response).

[0034] This application effectively addresses key issues in existing technologies, such as knowledge silos, semantic gaps, difficulties in knowledge completion, challenges in cross-domain knowledge fusion, low computational efficiency, and complex ontology management. Specifically, this application constructs a unified ontology framework to comprehensively encode the expression of knowledge in multiple dimensions, including structure, semantics, and constraints, ensuring the integrity and standardization of knowledge modeling. It also projects knowledge from multi-source heterogeneous systems onto a unified semantic space that supports efficient computation through a multimodal mapping mechanism, achieving automatic knowledge completion, conflict resolution, and cross-domain fusion, significantly improving the integrity, consistency, and generalization ability of the knowledge base.

[0035] The above describes the main technical solution of this application. Further implementations of the main technical solution are now introduced. Details are as follows: Regarding S101, which defines a knowledge framework based on application scenarios to obtain an ontology knowledge framework, this application provides an optional embodiment: Entity types are defined in the knowledge framework based on the application scenario, and an entity type system is built based on the entity types.

[0036] The entity type system defines all entity types in the knowledge system (such as hosts, users, processes, files, network connections, alarms, threats, etc. in security posture analysis). Each entity type includes attribute definitions, constraints, role mappings, etc. The entity type system corresponds to the object type in Palantir's ontology modeling concept.

[0037] Based on the application scenario, define the entity relationship types of the knowledge framework, and construct a relationship type system based on the entity relationship types.

[0038] The relation type system defines the relation types between entities (such as "process startup", "network connection", "file access", "threat association" etc.). Each relation type includes source entity type, target entity type, relation attributes, time constraints, etc. The relation type system corresponds to the link concept in Palantir.

[0039] The knowledge framework defines the attributes of entities and relationships based on the application scenario, and constructs an attribute system based on the attributes of entities and relationships.

[0040] The attribute system defines the attributes of entities and relationships (such as the entity's "creation time" and "owner", and the relationship's "confidence" and "risk level"). Each attribute includes data type, value range, calculation rules, etc. The attribute system corresponds to the properties and calculated attributes in the Palantir ontology model.

[0041] The constraints of the knowledge framework are defined based on the application scenario, and a constraint system is constructed based on the constraints.

[0042] The constraint system defines the constraints on knowledge (such as "a process can only be started by one user" or "a network connection must have a source IP and a destination IP"), and supports hard constraints (must be satisfied) and soft constraints (preferred to be satisfied); the constraint system corresponds to the multiple inheritance role mapping in Palantir's ontology modeling concept.

[0043] An ontology knowledge framework is constructed based on the entity type system, relation type system, attribute system, and constraint system.

[0044] The ontology knowledge framework not only provides a structured, semantic, and verifiable knowledge modeling paradigm, but also embeds an ontology version management mechanism, supporting version control, change tracking, difference comparison, and canary release of ontology models. By modeling the ontology evolution process as a time-stamped sequence of events (such as adding entity types, modifying relation constraints, and upgrading attribute calculation logic), the observability and controllability of the ontology lifecycle are achieved. This mechanism is consistent with the event and time-series evolution concept in Palantir ontology modeling, providing a solid foundation for the continuous iteration and stable operation of the knowledge system.

[0045] Regarding S102, which maps the knowledge in the knowledge base of each source to the ontology knowledge framework to obtain mapping data, this application provides an optional embodiment: Based on the knowledge type and the ontology knowledge framework, the knowledge in the knowledge base of each source is mapped to obtain the mapping result of each knowledge in the knowledge base of each source.

[0046] For example, perform the following operation on any knowledge in any source's knowledge base: If the knowledge type is structured knowledge (such as relational database tables, CSV files, etc.), then the entity type system in the ontology knowledge framework maps the rows of the relational table of the structured knowledge to entity objects, the attribute system in the ontology knowledge framework maps the columns of the relational table of the structured knowledge to entity attributes, the relation type system in the ontology knowledge framework maps the foreign key relationships of the structured knowledge to relationships between entities, and the constraint system in the ontology knowledge framework maps the constraints of the structured knowledge (such as CHECK, UNIQUE) to ontology constraints, thus obtaining the mapping result of the knowledge. This mapping process also supports mapping complex SQL query results (such as multi-table JOIN, aggregate function output) to entity sets, realizing a seamless conversion from operational data to ontology semantic models.

[0047] If the knowledge type is semantic knowledge (such as RDF triples, OWL ontology, SPARQL query results, etc.), then the entity type system and relation type system in the ontology knowledge framework are used to map the semantic knowledge triples (such as RDF triples) to ontology representations (such as entity-relation-entity), the semantic knowledge ontology (such as OWL ontology) to type definitions in the ontology framework, the semantic knowledge query results (such as SPARQL query results) to entity sets, and the semantic knowledge inference relations to inference rules, thus obtaining the mapping result of the knowledge. Furthermore, the implicit semantic relations of semantic knowledge can be converted into soft constraints supported by the ontology framework, thereby achieving semantic interoperability and knowledge fusion. This process also supports cross-ontology term alignment, concept disambiguation, and conflict resolution.

[0048] If the knowledge type is vector knowledge (such as embedded vectors, cluster centers, similarity matrices, etc.), then the attribute system in the ontology knowledge framework is used to map the vector representation of the vector knowledge to the semantic vector attributes of the entities, supporting subsequent vector-based retrieval and calculation. The clustering results of the vector knowledge vectors are mapped to the semantic categories of the entities. The relation type system in the ontology knowledge framework is used to map the vector similarity calculation results of the vector knowledge to the semantic similarity relations between entities (such as converting the similarity, distance, or attention weight between vectors into relation instances such as "semantic similarity" or "potential association", and assigning confidence or strength attributes), thus obtaining the mapping result of the knowledge. This mapping also supports dimensionality reduction of vectors (such as t-SNE, UMAP) for visualization analysis, assisting in manual verification and knowledge discovery.

[0049] If the knowledge type is unstructured knowledge (such as logs, reports, alarm texts, work orders, etc.), entities and relations are extracted from the text of the unstructured knowledge (e.g., using NLP technology to extract entities and relations from the text of the unstructured knowledge). The extracted entities are mapped to entity objects using the entity type system in the ontology knowledge framework, and the extracted relations are mapped to relations between entities using the relation type system in the ontology knowledge framework, thus obtaining the mapping result of the knowledge. In this process, entity linking technology is used to associate mentions with known entities, and the relation classification model is used to improve the accuracy of relation identification. A confidence score is added to each mapping result to support subsequent uncertain reasoning and priority ranking.

[0050] In practical deployments, the above mapping process can be uniformly driven by a rules engine. This application supports defining a domain-specific language (DSL) for mapping tasks, used to write, manage, and reuse mapping rules; rules support version control, canary releases, and rollback mechanisms to ensure the stability of the mapping logic evolution; built-in automatic rule validation capabilities can detect syntax errors, type mismatches, circular dependencies, and logical conflicts; and performance optimization strategies, such as rule compilation, cache reuse, and parallel execution, are provided to ensure the efficiency and scalability of large-scale knowledge mapping.

[0051] Through the unified mapping mechanism of the above-mentioned multi-type knowledge, this application realizes the efficient, accurate and maintainable transformation from heterogeneous and multimodal original knowledge sources to a standardized and computable ontology knowledge framework, laying the foundation for building a high-quality and highly consistent intelligent knowledge base.

[0052] Based on the mapping results of each knowledge in the knowledge base of each source, mapping data is obtained.

[0053] Regarding S103 storing the mapped data into the ontology knowledge framework to obtain the stored ontology knowledge framework, this application provides an optional embodiment: The entity attributes, relationships between entities, or ontology constraints in the mapped data are stored in a relational database management system (such as an RDBMS, which uses a normalized design, supports ACID transactions, and supports complex SQL queries and aggregation operations, serving as a "normal source" of knowledge to ensure data consistency and integrity). The ontology representation, type definitions, entity sets, inference rules, or ontology constraints in the mapped data are stored in a semantic data management system (such as a KG, which uses a graph database (such as Neo4j) or RDF triples for storage, supports SPARQL queries and OWL inference, serving as a semantic network of knowledge and supporting complex association analysis). The semantic vector attributes of entities, semantic categories of entities, or semantic similarity relationships between entities are stored in a vector data management system (such as a VDB, which uses a vector database (such as Milvus or Weaviate), supports efficient vector similarity calculation and ANN search, serving as a computational space for knowledge and supporting neural network inference), resulting in the stored ontology knowledge framework.

[0054] Relational Database Management Systems (RDBMS), as a standardized source of knowledge, employ normalized design and strictly adhere to the ACID transaction principles. They are used to persistently store entity attributes, relational instances between entities, and ontology constraints (such as uniqueness, value range, and existence constraints) in mapped data. This system supports complex SQL queries, multi-table joins, window functions, and aggregate analysis, ensuring high-fidelity representation of core business knowledge at the structural, logical, and consistency levels, and providing upper-layer applications with an authoritative, stable, and auditable data view.

[0055] The semantic data management system, as a semantic network of knowledge, is built upon graph databases (such as Neo4j) or RDF triple storage engines. It stores ontology representations (including entity-relation-entity triples), type definitions within the ontology framework (such as classes, attributes, and axioms), entity sets, inference rules (such as Datalog rules and SWRL rules), and the logical forms of some ontology constraints. The system natively supports the SPARQL query language and OWL / RDFS inference capabilities, enabling efficient execution of complex association analysis tasks such as path traversal, subgraph matching, concept classification, and implication inference, revealing implicit semantics and deep dependencies.

[0056] The vector data management system serves as a computational space for knowledge, relying on high-performance vector databases (such as Milvus, Weaviate, and Qdrant) to store the semantic vector attributes of entities (such as text embeddings, graph embeddings, and multimodal feature vectors), the semantic categories of entities (such as clustering labels and latent topics), and the semantic similarity relationships between entities (such as nearest neighbor relationships generated based on cosine similarity or distance metrics). This system supports efficient Approximate Nearest Neighbor (ANN) search, batch vector insertion, and dynamic index updates, and can be seamlessly integrated with neural network models to support data-driven intelligent computing tasks such as semantic retrieval, anomaly detection, and recommendation ranking.

[0057] Through the organic synergy of the three-layer storage architecture, RDBMS ensures the standardization and integrity of data, the semantic database carries the logical structure and reasoning capabilities, the vector database empowers semantic computing and intelligent discovery, and the ontology knowledge framework realizes full-stack knowledge management from "static description" to "dynamic reasoning" and then to "learnable evolution", ultimately forming a computable knowledge system with strong consistency, high expressiveness and high computational efficiency.

[0058] In practical implementation, when data in the RDBMS is updated, updates to the KG and VDB are automatically triggered. Full or incremental synchronization is performed periodically to ensure the consistency of the three layers of data. When inconsistencies occur in the three layers of data, they are automatically detected and resolved according to priority rules. Asynchronous synchronization and batch operations are used to improve synchronization efficiency. Consistency check rules are defined to periodically verify the consistency of the three layers of data. Hierarchical consistency management (strong consistency, eventual consistency, etc.) is supported, and consistency repair tools are provided to support automatic repair of inconsistent data.

[0059] Regarding the knowledge completion and fusion processing performed on the stored ontology knowledge framework in step S104 to obtain the processed ontology knowledge framework, this application provides an optional embodiment: Based on the stored ontology knowledge framework, a set of missing knowledge is obtained.

[0060] The set of missing knowledge includes at least one of the following: first missing knowledge, second missing knowledge, third missing knowledge, and fourth missing knowledge.

[0061] The first missing knowledge is obtained using the reasoning rules in the stored ontology knowledge framework. For example, if the rule "process A starts process B, process B accesses file C" is defined, when "process A starts process B" is observed, it can be deduced that "process A indirectly accesses file C".

[0062] The second missing knowledge is obtained by using vector similarity calculation based on the stored ontology knowledge framework. For example, the similarity between "unknown threats and known threats" is discovered through vector similarity to complete the attributes of the threats.

[0063] The third missing knowledge is obtained by utilizing the graph's topological structure based on the stored ontology knowledge framework. For example, it can be used to discover "the implicit relationship between two seemingly unrelated entities" through path completion.

[0064] The fourth missing knowledge is obtained by using a large language model based on the stored ontology knowledge framework. For example, the large model is used to analyze log text and complete the context information of the event.

[0065] The stored ontology knowledge framework is completed based on the missing knowledge set to obtain the completed ontology knowledge framework.

[0066] A fusion mechanism is used to fuse the completed ontology knowledge framework to obtain the ontology knowledge framework to be evaluated.

[0067] The fusion mechanism includes a first fusion strategy, a second fusion strategy, and a third fusion strategy.

[0068] The first fusion strategy is based on attribute similarity and relationship consistency. For example, entity linking technology is used to identify the same entities from different sources and fuse them based on attribute similarity and relationship consistency, supporting confidence scoring of the fusion.

[0069] The second fusion strategy is based on the semantic similarity of relationships. For example, it uses relationship classification technology to identify the same relationship from different sources. It also supports the detection and resolution of relationship conflicts.

[0070] The third fusion strategy is to use an aggregation strategy of entity attributes for fusion. For example, when the attributes of the same entity come from different sources, an aggregation strategy of attribute values ​​(such as taking the latest value, taking multiple values, taking the average value, etc.) is used for fusion, which supports version management and traceability of attributes.

[0071] Calculate the quality index of the ontology knowledge framework to be evaluated. If the quality index meets the preset conditions, the ontology knowledge framework to be evaluated is used as the processed ontology knowledge framework. The quality index includes at least one of the precision value, recall value and harmonic mean. The harmonic mean is calculated based on the precision value and recall value.

[0072] If the quality indicators do not meet the preset conditions, then return to the step of "obtaining the missing knowledge set based on the stored ontology knowledge framework".

[0073] Figure 2 The flowchart for the completion and fusion provided in the embodiments of this application is as follows: Figure 2 As shown, missing knowledge discovery is performed, and a rule-based completion path is initiated: this path relies on a reasoning rule base defined by domain experts or automatically mined (e.g., "A–R1→B∧B–R2→C"). A–R3→C”, through rule application, deduce missing knowledge, generate complete results, and enter the knowledge fusion mechanism (unification of multi-source knowledge).

[0074] The knowledge fusion mechanism consists of three parallel but complementary technical routes: Entity-level fusion: addressing ambiguity and redundancy issues at the entity level; Entity linking technology is used to map mentions in unstructured text to entities in the knowledge base; Utilize attribute similarity calculations (such as name, description, type, and contextual features) to determine whether entities are the same object; Merge duplicate entities based on fusion decision-making (such as spectral clustering, DBSCAN); Finally, the fusion result is output by scoring the confidence level of the fusion result.

[0075] Relational fusion: focusing on the reliability and semantic consistency of predicates (relations) in triples.

[0076] The equivalence of relation representations can be measured by performing semantic similarity calculations (such as cosine similarity based on word vectors, graph embeddings, or pre-trained language models) using relation classification techniques. Conflict detection and resolution (rule priority, evidence weight voting, time constraints, etc.) are performed on conflicting relationships (such as a pair of entities with a mutually exclusive relationship, like "birthplace" vs. "deathplace"). Output the fusion result.

[0077] Multi-source attribute fusion: handling the heterogeneity and dynamic evolution of entity attribute values; Introduce attribute value update mechanisms (such as timestamp version control and source credibility weighting); Version management is performed based on aggregation strategies (such as latest value / multiple values / average value) using multi-source attribute values ​​to obtain the fusion result; The above three types of fusion results converge to computational quality indicators (such as accuracy / recall / F1) and a manual review feedback collection mechanism, allowing domain experts to label suspicious completion results and form a supervisory signal; on the one hand, it is used for algorithm optimization (such as adjusting fusion weights and correcting rules), and on the other hand, it directly drives the "algorithm optimization" cycle (dashed arrow), forming a continuous learning closed loop.

[0078] The algorithm is optimized based on the feedback results: Large Model: Utilize the large model for reasoning, text analysis, context completion, and knowledge derivation to obtain completion results.

[0079] Graph Topology: Based on graph topology analysis, path completion and implicit relationship discovery are performed, and relationship completion is performed based on the completion data to obtain the completion result.

[0080] Similarity: Based on vector similarity calculation, similar entities are discovered, and attribute completion is performed based on the discovery results to obtain the completed results.

[0081] The three completion results mentioned above are fed back to the knowledge fusion mechanism to provide a data foundation for subsequent optimization.

[0082] Regarding S105, which involves uniformly projecting the knowledge in the processed ontology knowledge framework onto a computationally permissible semantic space to obtain the target ontology knowledge framework, this application provides an optional embodiment: The entity objects of knowledge in the processed ontology knowledge framework are projected onto entity vectors in the semantic space that allows computation. The entity attributes and semantic vector attributes of knowledge in the processed ontology knowledge framework are projected onto attribute vectors in the semantic space that allows computation. The relationships between entities of knowledge in the processed ontology knowledge framework are projected onto relationship vectors in the semantic space that allows computation.

[0083] The similarity between each pair of entity vectors, relation vectors, and attribute vectors is calculated in the semantic space where computation is allowed, and the target ontology knowledge framework is obtained.

[0084] For example, the various knowledge elements in the processed ontology knowledge framework are mapped to a computable semantic vector space: Entity objects are projected as entity vectors through their associated relational attributes and the vector representations of adjacent entities; entity attributes (including literal values ​​and structured descriptions) are transformed into attribute vectors through encoding and embedding techniques (such as Transformer, attribute-aware embedding); and the relationships between entities are modeled as relation vectors using graph neural networks (GNN) or knowledge graph embedding (KGE, such as TransE, RotatE, ComplEx, etc.) methods.

[0085] Within this unified vector semantic space, various semantic computation operations are supported: The similarity between entities, relations, and attributes is calculated using metrics such as cosine similarity and Euclidean distance. It supports weighted similarity calculation and can dynamically adjust the contribution of each dimension based on the attribute importance, relation weight or context confidence defined in the ontology; By combining ontological constraints (such as class hierarchy, attribute domain / value domain, functional constraints, etc.), semantic distance and effective path that conform to logical consistency are defined in vector space; It supports shortest-term semantic path query and k-hop neighborhood retrieval, and can perform interpretable semantic restoration of the discovered paths (e.g., mapping vector paths back to natural language relational chains such as "birthplace → location → country").

[0086] This mechanism not only achieves a deep integration of symbolic ontology knowledge and continuous vector representation, but also provides a unified foundation for downstream tasks (such as link prediction, entity alignment, and question answering reasoning) that combines computational efficiency and semantic interpretability.

[0087] After projecting knowledge elements into a semantic vector space, efficient and scalable hybrid reasoning can be performed within this space. For example, transitivity rules (such as "if A→B and B→C, then A→C") can be approximated through vector operations, encoding complex logical or semantic reasoning rules into geometric operations in the vector space. A collaborative mechanism of symbolic reasoning and vector reasoning is adopted: for scenarios with strong logical constraints and well-defined rules (such as ontology axioms, functional relations, mutually exclusive classes, etc.), the symbolic reasoning engine is used first to ensure strict consistency of results; while for tasks with ambiguous semantics and relying on contextual similarity (such as entity alignment, implicit relation discovery), vector reasoning is used to capture implicit patterns by leveraging the continuity and generalization capabilities of the embedding space; the two are integrated through a unified interface, supporting dynamic routing and result fusion to achieve complementary advantages.

[0088] To improve efficiency and scalability, incremental reasoning is supported: when new knowledge is injected, only local recomputation of the affected subgraph or neighborhood is triggered, avoiding full graph re-reasoning; at the same time, the reasoning results can be cached and reused, significantly reducing the overhead of repeated queries. In terms of performance, millisecond-level knowledge query and reasoning responses are achieved. Key technologies include using efficient vector index structures (such as HNSW, IVF-PQ) to accelerate nearest neighbor search and similarity matching, applying query optimization strategies (such as pruning, early termination, and predicate pushdown) to reduce invalid computation, and utilizing parallel computing frameworks (CPU / GPU multi-threading, batch processing) to improve throughput.

[0089] Furthermore, it fully supports streaming data processing and real-time reasoning: new knowledge can be written in real time and trigger an instant reasoning pipeline, supporting real-time anomaly detection and alerts (such as violations of ontology constraints, semantic drift, and conflicting triples); the architecture adopts a distributed design, supports sharded storage and computation of knowledge graphs, and ensures the consistency and integrity of distributed reasoning through cross-node coordination protocols (such as message queues or consensus mechanisms), taking into account accuracy, real-time performance, scalability, and interpretability, making it suitable for online reasoning and intelligent service scenarios of large-scale dynamic knowledge graphs.

[0090] Figure 3 A flowchart of the projection provided in the embodiments of this application is shown below. Figure 3 As shown, entity projection is performed on entity objects (such as entity projection using GNN / KGE calculation), relation projection is performed on relationships between entities (such as calculation using attribute + connection, i.e., calculation through the attribute of the relationship and the entity vector of the connection), and attribute projection is performed on attributes (such as encoding + embedding, i.e., projection through the encoding and embedding of attribute values).

[0091] In the vector space, cosine similarity, Euclidean distance, and weighted similarity (considering ontology constraints) are calculated between each pair of entity vector sets, relation vector sets, and attribute vector sets to obtain a similarity matrix. Distance is defined in the vector space, and semantic interpretation of paths is performed using minimum path query or K-hop domain query. Vector space reasoning and vector operation derivation can also be performed. For example, symbol verification is performed on high-confidence vector inference results, or vector similarity is introduced to sort and disambiguate paths with ambiguity in symbol reasoning. At the same time, "composite rule representation" (such as vectorized approximation of A→B ∧ B→C → A→C + symbol verification) is supported, and the final inference result set is output.

[0092] The system integrates the two types of evidence to generate a final credibility score based on the collaborative reasoning results. Unqualified results are marked and sent back to upstream modules (e.g., triggering rule correction, vector retraining, or topology adjustment), forming a feedback loop. After successful verification, the system performs incremental derivation, only recalculating and updating the indexes of the affected subgraphs. Subsequently, the affected results are calculated, triggering inference result cache updates and result reuse scheduling to ensure millisecond-level response capabilities. Finally, it provides low-latency knowledge query and inference services, supporting real-time streaming data access and distributed deployment.

[0093] To ensure the long-term effectiveness of the target ontology knowledge framework, this application provides an optional embodiment for optimizing the target ontology knowledge framework: Real-time collection of usage feedback data for the target ontology knowledge framework; real-time optimization of the target ontology knowledge framework based on the usage feedback data.

[0094] For example, continuous collection of multi-dimensional feedback drives closed-loop optimization of knowledge reasoning capabilities. On one hand, it proactively acquires explicit user feedback on reasoning results, including positive feedback (e.g., the reasoning is correct) and negative feedback (e.g., the reasoning is incorrect), and supports fine-grained annotation, allowing users to point out specific error locations (e.g., incorrect relation direction, mismatched attribute values, or misjudged entity types). On the other hand, it automatically collects implicit feedback during system operation, covering reasoning performance metrics (e.g., accuracy, recall, F1 score), performance metrics (e.g., query response time, throughput, resource utilization), knowledge consistency check results (e.g., ontology conflicts, logical contradictions, value range violations), and practical feedback at the business application level—for example, in security situation analysis scenarios, collecting key operational metrics such as the true positive rate, false positive rate, and false negative rate of alerts, as well as the accuracy and false negative rate of threat detection.

[0095] Based on the above feedback, the knowledge representation and reasoning mechanisms are dynamically optimized: the ontology definition is adjusted, including revising the semantic boundaries of entity types or relation types, and relaxing or tightening the strictness of constraints; the importance weights of attributes are updated to affect similarity calculation and weighted reasoning; mapping rules are optimized, including adjusting parameters, adding high-value rules, or deleting / disabling inefficient, redundant, or even conflict-causing rules; the reasoning rule base is managed in a refined manner, controlling the aggressiveness of reasoning by adjusting the confidence threshold, introducing new rules to cover emerging patterns, and eliminating outdated rules to reduce noise. Simultaneously, iterative evolution of the vector model is triggered: the embedding model is retrained based on new labeled data or feedback samples, adjusting the vector dimension, similarity measurement method (e.g., switching from cosine to Mahalanobis distance), or introducing transfer learning strategies to leverage pre-trained knowledge to improve generalization ability in specific domains or low-resource scenarios.

[0096] In addition, the system regularly performs comprehensive knowledge quality assessments, generating quality scores based on dimensions such as logical consistency, semantic integrity, timeliness, and business relevance. Based on these scores, it automatically or semi-automatically performs knowledge cleaning and repair operations, such as merging duplicate entities, correcting erroneous attributes, completing missing relationships, or removing outdated facts, thereby continuously improving the reliability, usability, and intelligent service level of the knowledge graph.

[0097] Figure 4 The optimized flowchart provided for the embodiments of this application is as follows: Figure 4 As shown, three key feedback entry points are listed side-by-side, each corresponding to different dimensions of knowledge usage effectiveness: Feedback database: positive feedback, negative feedback, and fine-grained annotation of specific error locations, mainly from manual review, alarm handling results, analyst annotations, etc., reflecting the correctness and practicality of knowledge in specific scenarios (such as "rule false alarms", "missed alarms", "entity recognition errors"); Performance metrics library: Includes quantitative metrics such as accuracy, recall, F1 score, response time, throughput, consistency check, and data quality, reflecting the operational efficiency and stability of the knowledge system; Business metrics library: including true positive rate, false positive rate, security posture, detection accuracy, missed detection rate, business effectiveness, application effectiveness, etc.; such as "security posture improvement", "average response time reduction", "business interruption reduction", etc., mapping knowledge effectiveness to real business value, ensuring that optimization direction is aligned with organizational goals.

[0098] These three types of inputs converge into feedback-based optimization: Optimized version management is achieved through entity / relationship type adjustment, attribute weight adjustment, and constraint optimization. The accuracy of the optimized version is evaluated, and a quality report is generated. Based on the quality report, abnormal data monitoring, data repair, missing data completion, and cleaning result verification are performed, with this optimization feedback loop continuously iterating and updating. Once optimization is complete, the model is retrained using transfer learning, and accuracy is evaluated again. In specific applications, optimization also includes adjusting rule parameters, deleting inefficient rules, and adding new rules to complete rule performance optimization. After rule performance optimization, integrity evaluation is performed, resulting in a quality report. Optimization may also include confidence threshold adjustment (such as adding new inference rules, validating rule validity, and disabling inefficient rules), followed by consistency evaluation, and the evaluation results are added to the quality report. Optimization may also include entity / relationship type adjustment, followed by confidence threshold adjustment based on the adjustment results.

[0099] Figure 5 A schematic diagram of the ontology knowledge framework construction method provided in the embodiments of this application, as shown below. Figure 5 As shown, with enterprise security threat detection and situational analysis as the core objective, four typical inputs are derived: alarm data (historical alarms or events), rule base (such as security rules, threat models, detection rules, and response plans), threat intelligence (such as malicious IPs, domain names, or hashes), and network logs (raw log streams of traffic, hosts, terminals, etc.).

[0100] The above input data is parsed using logs (e.g., extracted using NLP techniques) to obtain the corresponding entity types (e.g., hosts, users, processes, files, network connections, alarms, and threats), relationship types (e.g., process startup, network connection, file access, and threat association), and attribute definitions (e.g., time, confidence level, and risk level). The extracted entity types, relationship types, and attributes, along with alarm mappings (historical data fusion), are stored in the RDBMS database (structured time storage). The intelligence mappings (threat indicator standardization) are stored in the KG database (threat association network), and the rule mappings (inference rule transformation) are stored in the VDB database. Based on the RDBMS database, KG database, and VDB database, rule inference is performed to determine hidden threat associations.

[0101] Vector similarity calculations are performed using RDBMS, KG, and VDB databases to identify unknown threats; graph completion is performed using these databases to discover attack chains; multi-source fusion is used to integrate latent threat associations, unknown threats, and attack chains to achieve a unified threat representation; vector space projection processing is performed, followed by inference and threat similarity calculations within the vector space, with hybrid inference based on symbols and vectors to achieve millisecond-level inference; attack chains are constructed in the vector space, supporting visualized situation reports with millimeter-level response latency, attack chain integrity greater than or equal to 95%, and threat alerts at 85-92%; real-time business feedback (such as true positive rate and false positive rate), system metrics, and analyst feedback (such as alert accuracy) are received, and model optimization (such as rule and vector adjustments) is performed based on the feedback data.

[0102] This application also provides two specific application examples: The first embodiment is applied to the scenario of multi-source knowledge fusion and threat detection in security situation analysis: A company needs to conduct a security posture analysis, which requires integrating knowledge from multiple sources: Network logs contain millions of events such as network connections, process startups, and file accesses; Threat intelligence includes known malicious IPs, malicious domains, and malicious file hashes. Rule base: Contains enterprise-defined security rules and threat models; Alarm data: includes existing security alerts and events; The goal is to integrate this multi-source knowledge into a unified knowledge system for threat detection and situational analysis.

[0103] Processing flow: Ontology framework definition: Define entity types such as host, user, process, file, network connection, alarm, threat, etc., as well as relationship types such as process startup, network connection, file access, threat association, etc.

[0104] Multimodal knowledge mapping: Maps multi-source knowledge, such as network logs, threat intelligence, rule bases, and alert data, to a unified ontology framework. NLP techniques are used to extract entities and relationships from log text.

[0105] Three-tier collaborative storage: Structured knowledge is stored at the RDBMS layer, semantic relationships and inference rules are stored at the KG layer, and entity vector representations are stored at the VDB layer. Event-driven synchronization maintains data consistency across the three layers.

[0106] Knowledge Completion and Fusion: Multi-layered completion based on rules, vectors, graphs, and large models to discover missing threat relationships. Entity fusion, relationship fusion, and attribute fusion to unify multi-source knowledge.

[0107] Unified Semantic Space and Reasoning: Projects entities and relations into a vector space and employs hybrid reasoning (symbolic reasoning + vector reasoning) for threat detection. Supports millisecond-level real-time reasoning.

[0108] Knowledge Feedback and Optimization: Collect feedback from security analysts and system performance metrics to optimize inference rules, vector models, and ontology frameworks.

[0109] This embodiment verifies the effectiveness of the system in security situation analysis, successfully integrating knowledge from four sources: network logs, threat intelligence, rule base, and alarm data. The completeness of the knowledge base is improved from 70% to 95%, from 60%~70% in the existing technology to 85%~92%, and reduced from 20%~30% in the existing technology to 5%~10%, from seconds to milliseconds. It supports real-time detection, reduces costs by 40%~60%, and supports rapid business adaptation.

[0110] The second embodiment is applied to the scenario of unified cross-domain knowledge representation in enterprise knowledge management: A large enterprise has multiple business units, each with its own knowledge base and data system. The enterprise needs to establish a unified knowledge system to support cross-departmental knowledge sharing and collaboration.

[0111] Knowledge sources include: Human Resources System: Employee information, organizational structure, job definitions, etc. Project management system: Project information, task assignment, progress tracking, etc. Document library: various documents, reports, best practices, etc.; Business rule base: Enterprise rules, process definitions, decision rules, etc.; The goal is to unify the representation of this heterogeneous knowledge, supporting cross-departmental knowledge retrieval, reasoning, and decision support.

[0112] Processing flow: Ontology framework definition: Define entity types such as employees, departments, projects, tasks, documents, and rules, as well as relationship types such as belonging, participating, assigning, containing, associating, and applicable.

[0113] Multimodal knowledge mapping: Mapping knowledge from heterogeneous systems such as human resource systems, project management systems, document libraries, and business rule bases to a unified ontology framework. NLP techniques are used to extract key entities and relationships from documents.

[0114] Three-tier collaborative storage: The RDBMS layer stores structured employee, project, and task information; the KG layer stores cross-departmental relationships and rules; and the VDB layer stores entity vector representations.

[0115] Knowledge completion and fusion: Based on rules, the implicit employee-task relationship is derived, and based on vector similarity, employees with similar skills are discovered, and entities and relationships are fused.

[0116] Unified Semantic Space and Reasoning: Supports cross-departmental knowledge query and reasoning within a unified semantic space, such as employee recommendation and project risk prediction.

[0117] Knowledge Feedback and Optimization: Collect user feedback to optimize inference rules and vector models, supporting rapid business adaptation.

[0118] This embodiment verifies the effectiveness of the system in enterprise knowledge management, successfully integrating knowledge from four heterogeneous systems, supporting cross-departmental knowledge queries, improving from separate queries in multiple systems to unified system queries, reducing query time from seconds to milliseconds, supporting complex cross-departmental reasoning, such as employee recommendations and project risk prediction, and discovering missing relationships in the original system through knowledge completion, improving the completeness of the knowledge base by 30% to 40%.

[0119] Compared with existing technologies, the technical solution of this application significantly improves the overall efficiency and practicality of the knowledge system. By constructing an ontology-driven unified semantic framework, it deeply collaborates with three heterogeneous data sources—relational database management system (RDBMS), knowledge graph (KG), and vector database (VDB)—breaking the knowledge silo problem caused by their independent operation in traditional architectures. Under this framework, the three databases interact and complement each other based on the same semantic model, which not only significantly reduces the cost of cross-system data synchronization from 30%~50% to 5%~10%, but also improves the efficiency of multidimensional representation and joint computation of knowledge by 3 to 5 times.

[0120] This application utilizes a vector space projection mechanism to uniformly map structured triples, semantic relations, and high-dimensional embeddings to a computable continuous semantic space, effectively bridging the gap between structured data and semantic understanding in traditional methods. This capability is particularly crucial in security situation analysis scenarios: the system can align, correlate, and infer discrete log events with abstract threat semantics (such as TTPs) in the same space, thereby significantly improving threat detection accuracy from 60%~70% to 85%~92%.

[0121] Addressing the pain points of knowledge bases' long-term reliance on manual maintenance and insufficient completeness, this application introduces a multi-layered automatic completion mechanism that integrates rule-based reasoning, vector completion, graph neural networks, and large language model prompts. This mechanism can proactively discover and fill in missing entities, relationships, or attributes. In practical applications, the completeness of the security knowledge base has thus jumped from 70%~80% to over 95%, automatically revealing a large number of previously hidden threat relationships.

[0122] Meanwhile, through refined entity alignment, relation normalization, and attribute fusion strategies, this application ensures that knowledge from heterogeneous sources such as network logs, external threat intelligence, and internal rule bases is organically integrated into a unified knowledge system, achieving standardized expression and collaborative utilization of cross-domain knowledge. Compared to the limitations of existing technologies in effectively integrating multi-source information, this application increases the coverage of threat detection by 40% to 60%, significantly enhancing the ability to perceive complex attacks such as advanced persistent threats (APTs).

[0123] In terms of performance, the system combines vector space approximate reasoning, symbolic-vector hybrid reasoning, and incremental graph update mechanism to compress the response time of complex reasoning tasks from seconds or even minutes to milliseconds at the scale of millions of entities, improving efficiency by 100 to 1000 times, truly meeting the needs of real-time security situation assessment and dynamic response.

[0124] Furthermore, this application designs an ontology management mechanism that supports version control, canary releases, and automated consistency verification, greatly simplifying the ontology evolution process. Compared to the long ontology change cycle and high risk of traditional methods, maintenance costs are reduced by 40% to 60%, and the upgrade cycle is shortened from several weeks to several days, enabling the knowledge system to agilely adapt to the rapid iteration of business rules and security policies.

[0125] In summary, this application systematically solves the core bottlenecks in existing technologies, such as knowledge silos, semantic fragmentation, difficulty in completion, inefficient fusion, high inference latency, and complex ontology maintenance. While improving the integrity, consistency, real-time performance, and maintainability of knowledge systems, it provides solid technical support for high-requirement application scenarios such as secure intelligent analysis, demonstrating outstanding innovation and significant application value.

[0126] Figure 6 A structural diagram of an ontology knowledge framework construction device provided in an embodiment of this application is shown below. Figure 6 As shown, based on the ontology knowledge framework construction method provided in the preceding embodiments, this application also provides an ontology knowledge framework construction apparatus, including: The definition module is used to define the knowledge framework based on the application scenario, and obtain the ontology knowledge framework. The mapping module is used to map the knowledge in the knowledge base of each source to the ontology knowledge framework to obtain mapping data; The storage module is used to store the mapped data into the ontology knowledge framework to obtain the stored ontology knowledge framework; The processing module is used to perform knowledge completion and fusion processing on the stored ontology knowledge framework to obtain the processed ontology knowledge framework. The projection module is used to uniformly project the knowledge in the processed ontology knowledge framework onto a semantic space that allows computation, thereby obtaining the target ontology knowledge framework.

[0127] As an optional embodiment, a module is defined, specifically including: The entity types of the knowledge framework are defined based on the application scenario, and an entity type system is built based on the entity types. Define the entity relationship types of the knowledge framework based on the application scenario, and construct a relationship type system based on the entity relationship types; The knowledge framework defines the attributes of entities and relationships based on the application scenario, and constructs an attribute system based on the attributes of entities and relationships. Define the constraints of the knowledge framework based on the application scenario, and construct a constraint system based on the constraints. An ontology knowledge framework is constructed based on the entity type system, relation type system, attribute system, and constraint system.

[0128] As an optional embodiment, the mapping module specifically includes: Based on the knowledge type and the ontology knowledge framework, the knowledge in the knowledge base of each source is mapped to obtain the mapping result of each knowledge in the knowledge base of each source. Based on the mapping results of each knowledge in the knowledge base of each source, mapping data is obtained.

[0129] As an optional embodiment, the knowledge in the knowledge base of each source is mapped based on the knowledge type and the ontology knowledge framework to obtain the mapping result of each knowledge in the knowledge base of each source, specifically including: Perform the following on any knowledge in any source's knowledge base: If the knowledge type is structured knowledge, then the entity type system in the ontology knowledge framework is used to map the rows of the relation table of the structured knowledge to entity objects, the attribute system in the ontology knowledge framework is used to map the columns of the relation table of the structured knowledge to entity attributes, the relation type system in the ontology knowledge framework is used to map the foreign key relations of the structured knowledge to relations between entities, and the constraint system in the ontology knowledge framework is used to map the constraints of the structured knowledge to ontology constraints, thereby obtaining the mapping result of the knowledge. If the knowledge type of the knowledge is semantic knowledge, then the entity type system and relation type system in the ontology knowledge framework are used to map the triples of the semantic knowledge to ontology representations, the ontology of the semantic knowledge to type definitions in the ontology framework, the query results of the semantic knowledge to entity sets, and the inference relations of the semantic knowledge to inference rules, so as to obtain the mapping results of the knowledge. If the knowledge type of the knowledge is vector knowledge, then the attribute system in the ontology knowledge framework is used to map the vector representation of the vector knowledge to the semantic vector attributes of the entity, the clustering result of the vectors of the vector knowledge is mapped to the semantic category of the entity, and the relation type system in the ontology knowledge framework is used to map the vector similarity calculation result of the vector knowledge to the semantic similarity relation between entities, so as to obtain the mapping result of the knowledge. If the knowledge type is unstructured knowledge, then entities and relations are extracted from the text of the unstructured knowledge. The extracted entities are mapped to entity objects using the entity type system in the ontology knowledge framework, and the extracted relations are mapped to relations between entities using the relation type system in the ontology knowledge framework, thus obtaining the mapping result of the knowledge.

[0130] As an optional embodiment, the storage module specifically includes: The entity attributes, relationships between entities, or ontology constraints in the mapping data are stored in the relational database management system of the ontology knowledge framework. The ontology representation, type definition, entity set, inference rules, or ontology constraints in the mapping data are stored in the semantic data management system of the ontology knowledge framework. The semantic vector attributes of entities, semantic categories of entities, or semantic similarity relationships between entities are stored in the vector data management system of the ontology knowledge framework, thus obtaining the stored ontology knowledge framework.

[0131] As an optional embodiment, the processing module specifically includes: Based on the stored ontology knowledge framework, a set of missing knowledge is obtained; the set of missing knowledge includes at least one of the following: first missing knowledge, second missing knowledge, third missing knowledge, and fourth missing knowledge; the first missing knowledge is obtained using inference rules in the stored ontology knowledge framework; the second missing knowledge is obtained using vector similarity calculation based on the stored ontology knowledge framework; the third missing knowledge is obtained using the graph topology based on the stored ontology knowledge framework; and the fourth missing knowledge is obtained using a large language model based on the stored ontology knowledge framework. Based on the missing knowledge set, the stored ontology knowledge framework is completed to obtain the completed ontology knowledge framework. A fusion mechanism is used to fuse the completed ontology knowledge framework to obtain the ontology knowledge framework to be evaluated. The fusion mechanism includes a first fusion strategy, a second fusion strategy, and a third fusion strategy. The first fusion strategy is based on attribute similarity and relation consistency. The second fusion strategy is based on the semantic similarity of relations. The third fusion strategy is based on the aggregation strategy of entity attributes. Calculate the quality index of the ontology knowledge framework to be evaluated. If the quality index meets the preset conditions, the ontology knowledge framework to be evaluated is used as the processed ontology knowledge framework. The quality index includes at least one of the following: accuracy, recall, and harmonic mean. If the quality indicators do not meet the preset conditions, then return to the step of "obtaining the missing knowledge set based on the stored ontology knowledge framework".

[0132] As an optional embodiment, the projection module specifically includes: Project the entity objects of knowledge in the processed ontology knowledge framework onto entity vectors in the semantic space that allows computation; project the entity attributes and semantic vector attributes of knowledge in the processed ontology knowledge framework onto attribute vectors in the semantic space that allows computation; and project the relationships between entities of knowledge in the processed ontology knowledge framework onto relationship vectors in the semantic space that allows computation. The similarity between each pair of entity vectors, relation vectors, and attribute vectors is calculated in the semantic space where computation is allowed, and the target ontology knowledge framework is obtained.

[0133] As an optional embodiment, the apparatus further includes: An optimization module is used to collect usage feedback data of the target ontology knowledge framework in real time; and to perform real-time optimization processing on the target ontology knowledge framework based on the usage feedback data.

[0134] This application provides a computer device, including: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement an ontology knowledge framework construction method.

[0135] This application provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements an ontology knowledge framework construction method.

[0136] This application provides a computer program product, including a computer program that, when executed by a processor, implements an ontology knowledge framework construction method.

[0137] It should be noted that the various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, for the device and equipment embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the description of the method embodiments. The device and equipment embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components indicated as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of the solution in this embodiment according to actual needs. Those skilled in the art can understand and implement this without creative effort.

[0138] The above description is merely one specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for constructing an ontology knowledge framework, characterized in that, The method includes: The ontology knowledge framework is obtained by defining the knowledge framework based on the application scenario. The knowledge in the knowledge base of each source is mapped to the ontology knowledge framework to obtain the mapping data; The mapping data is stored in the ontology knowledge framework to obtain the stored ontology knowledge framework; The stored ontology knowledge framework is subjected to knowledge completion and fusion processing to obtain the processed ontology knowledge framework. The knowledge in the processed ontology knowledge framework is uniformly projected onto a computationally allowed semantic space to obtain the target ontology knowledge framework.

2. The ontology knowledge framework construction method according to claim 1, characterized in that, The definition of the knowledge framework based on application scenarios, resulting in the ontology knowledge framework, specifically includes: The entity types of the knowledge framework are defined based on the application scenario, and an entity type system is built based on the entity types. Define the entity relationship types of the knowledge framework based on the application scenario, and construct a relationship type system based on the entity relationship types; The knowledge framework defines the attributes of entities and relationships based on the application scenario, and constructs an attribute system based on the attributes of entities and relationships. Define the constraints of the knowledge framework based on the application scenario, and construct a constraint system based on the constraints. An ontology knowledge framework is constructed based on the entity type system, relation type system, attribute system, and constraint system.

3. The ontology knowledge framework construction method according to claim 1, characterized in that, The step of mapping the knowledge in the knowledge base of each source to the ontology knowledge framework to obtain mapping data specifically includes: Based on the knowledge type and the ontology knowledge framework, the knowledge in the knowledge base of each source is mapped to obtain the mapping result of each knowledge in the knowledge base of each source. Based on the mapping results of each knowledge in the knowledge base of each source, mapping data is obtained.

4. The ontology knowledge framework construction method according to claim 3, characterized in that, The mapping process based on knowledge type and ontology knowledge framework to the knowledge in the knowledge base of each source, to obtain the mapping result of each knowledge in the knowledge base of each source, specifically includes: Perform the following on any knowledge in any source's knowledge base: If the knowledge type is structured knowledge, then the entity type system in the ontology knowledge framework is used to map the rows of the relation table of the structured knowledge to entity objects, the attribute system in the ontology knowledge framework is used to map the columns of the relation table of the structured knowledge to entity attributes, the relation type system in the ontology knowledge framework is used to map the foreign key relations of the structured knowledge to relations between entities, and the constraint system in the ontology knowledge framework is used to map the constraints of the structured knowledge to ontology constraints, thereby obtaining the mapping result of the knowledge. If the knowledge type of the knowledge is semantic knowledge, then the entity type system and relation type system in the ontology knowledge framework are used to map the triples of the semantic knowledge to ontology representations, the ontology of the semantic knowledge to type definitions in the ontology framework, the query results of the semantic knowledge to entity sets, and the inference relations of the semantic knowledge to inference rules, so as to obtain the mapping results of the knowledge. If the knowledge type of the knowledge is vector knowledge, then the attribute system in the ontology knowledge framework is used to map the vector representation of the vector knowledge to the semantic vector attributes of the entity, the clustering result of the vectors of the vector knowledge is mapped to the semantic category of the entity, and the relation type system in the ontology knowledge framework is used to map the vector similarity calculation result of the vector knowledge to the semantic similarity relation between entities, so as to obtain the mapping result of the knowledge. If the knowledge type is unstructured knowledge, then entities and relations are extracted from the text of the unstructured knowledge. The extracted entities are mapped to entity objects using the entity type system in the ontology knowledge framework, and the extracted relations are mapped to relations between entities using the relation type system in the ontology knowledge framework, thus obtaining the mapping result of the knowledge.

5. The ontology knowledge framework construction method according to claim 1, characterized in that, The step of storing the mapped data into the ontology knowledge framework to obtain the stored ontology knowledge framework specifically includes: The entity attributes, relationships between entities, or ontology constraints in the mapping data are stored in the relational database management system of the ontology knowledge framework. The ontology representation, type definition, entity set, inference rules, or ontology constraints in the mapping data are stored in the semantic data management system of the ontology knowledge framework. The semantic vector attributes of entities, semantic categories of entities, or semantic similarity relationships between entities are stored in the vector data management system of the ontology knowledge framework, thus obtaining the stored ontology knowledge framework.

6. The ontology knowledge framework construction method according to claim 1, characterized in that, The step of performing knowledge completion and fusion processing on the stored ontology knowledge framework to obtain a processed ontology knowledge framework specifically includes: Based on the stored ontology knowledge framework, a set of missing knowledge is obtained; the set of missing knowledge includes at least one of the following: first missing knowledge, second missing knowledge, third missing knowledge, and fourth missing knowledge; the first missing knowledge is obtained using inference rules in the stored ontology knowledge framework; the second missing knowledge is obtained using vector similarity calculation based on the stored ontology knowledge framework; the third missing knowledge is obtained using the graph topology based on the stored ontology knowledge framework; and the fourth missing knowledge is obtained using a large language model based on the stored ontology knowledge framework. Based on the missing knowledge set, the stored ontology knowledge framework is completed to obtain the completed ontology knowledge framework. A fusion mechanism is used to fuse the completed ontology knowledge framework to obtain the ontology knowledge framework to be evaluated. The fusion mechanism includes a first fusion strategy, a second fusion strategy, and a third fusion strategy. The first fusion strategy is based on attribute similarity and relation consistency. The second fusion strategy is based on the semantic similarity of relations. The third fusion strategy is based on the aggregation strategy of entity attributes. Calculate the quality index of the ontology knowledge framework to be evaluated. If the quality index meets the preset conditions, the ontology knowledge framework to be evaluated is used as the processed ontology knowledge framework. The quality index includes at least one of the following: accuracy, recall, and harmonic mean. If the quality indicators do not meet the preset conditions, then return to the step of "obtaining the missing knowledge set based on the stored ontology knowledge framework".

7. The ontology knowledge framework construction method according to claim 1, characterized in that, The step of uniformly projecting the knowledge in the processed ontology knowledge framework onto a computationally compliant semantic space to obtain the target ontology knowledge framework specifically includes: Project the entity objects of knowledge in the processed ontology knowledge framework onto entity vectors in the semantic space that allows computation; project the entity attributes and semantic vector attributes of knowledge in the processed ontology knowledge framework onto attribute vectors in the semantic space that allows computation; and project the relationships between entities of knowledge in the processed ontology knowledge framework onto relationship vectors in the semantic space that allows computation. The similarity between each pair of entity vectors, relation vectors, and attribute vectors is calculated in the semantic space where computation is allowed, and the target ontology knowledge framework is obtained.

8. The ontology knowledge framework construction method according to claim 1, characterized in that, The method further includes: Real-time collection of usage feedback data for the target ontology knowledge framework; The target ontology knowledge framework is optimized in real time based on the feedback data.

9. An ontology knowledge framework construction device, characterized in that, The ontology knowledge framework construction device includes: The definition module is used to define the knowledge framework based on the application scenario, and obtain the ontology knowledge framework. The mapping module is used to map the knowledge in the knowledge base of each source to the ontology knowledge framework to obtain mapping data; The storage module is used to store the mapped data into the ontology knowledge framework to obtain the stored ontology knowledge framework; The processing module is used to perform knowledge completion and fusion processing on the stored ontology knowledge framework to obtain the processed ontology knowledge framework. The projection module is used to uniformly project the knowledge in the processed ontology knowledge framework onto a semantic space that allows computation, thereby obtaining the target ontology knowledge framework.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the ontology knowledge framework construction method as described in any one of claims 1-8.

Images